How Access Control Systems Work: Credentials, Readers, Controllers, and Doors

The Four Core Parts and How a Single Unlock Happens

Every access control system, whether it guards one office door or an entire building, is built from the same four parts working in sequence. The credential is what a person carries or presents: a card, a key fob, a phone, or a fingerprint. The reader is the device mounted beside the door that detects the credential and reads its identifying data. The controller is the brain, usually a panel installed in a secure closet or above the door, that holds the list of who is allowed in and when. The door hardware is the physical lock, electric strike, or magnetic lock that actually holds the door shut or releases it.

Here is what happens in the roughly half-second it takes to walk through a controlled door. You present your card or fob to the reader. The reader captures the credential's unique number and passes it to the controller. The controller checks that number against its stored permissions: Is this credential valid? Is it allowed at this door? Is it allowed at this time of day? If every answer is yes, the controller sends a signal to the door hardware to release, and you pull the door open. If any answer is no, the door stays locked and the attempt is logged.

Because the decision lives in the controller and not in the lock itself, you can change who has access without ever touching the door. Lose a fob? It is deactivated in software and the physical fob becomes useless. That separation between permission and hardware is the whole point of access control and the reason it scales so well from a single suite to a multi-building campus.

• Credential: the card, fob, phone, or fingerprint a person presents
• Reader: the wall-mounted device that captures the credential
• Controller: the panel that decides yes or no based on stored rules
• Door hardware: the electric strike, magnetic lock, or electrified lock that releases or holds

Credentials: Cards, Fobs, Phones, and Fingerprints

A credential is simply proof of identity that the system can read electronically. The most common form is the proximity card or key fob, which you hold near a reader and which transmits a stored number over a short radio distance. Smart cards add encryption so the credential number cannot be easily copied, which matters for higher-security doors. Mobile credentials let an employee use a smartphone and an app instead of carrying a separate card, which removes the cost and waste of reissuing plastic and lets you grant access remotely.

Biometric credentials use something you are rather than something you carry, most often a fingerprint, and they shine where you cannot risk a borrowed or stolen card, such as a server room, pharmacy, or cash-handling area. The tradeoff is that biometrics can be slower per person and require enrollment, so many businesses use them only on their most sensitive interior doors while using cards or fobs on perimeter doors.

Many sites combine credential types for layered security. A front entrance might accept a card alone, while a vault or IT room requires a card plus a PIN or a card plus a fingerprint. This is called dual-factor access, and it is a straightforward way to put stronger protection only where you need it without slowing down everyone at the main door.

• Proximity cards and fobs: low cost, easy to issue, fine for most doors
• Smart cards: encrypted and far harder to clone for sensitive areas
• Mobile credentials: use a phone, issue or revoke remotely, no plastic to reorder
• Biometrics: tie access to the actual person for your highest-security rooms

Readers, Controllers, and the Door Hardware

The reader is the part people interact with, and it must match the credential type. A proximity reader detects cards and fobs, a keypad reader accepts a typed PIN, a biometric reader scans a fingerprint, and combination readers handle more than one method at the same door. Readers are wired back to the controller, and for many businesses the cleanest setup is one controller serving several doors from a central panel rather than independent units scattered around the building.

The controller stores the access rules and makes every decision. Modern controllers connect to management software, often browser-based, where you add and remove people, build schedules so a door unlocks automatically during business hours and locks after, group doors so a manager's card opens many rooms while a contractor's opens only one, and review a log of every entry. That log is one of the most valuable features: if something goes missing or a door is propped, you can see exactly which credential was used and when.

The door hardware is what physically secures the opening, and the right choice depends on the door. An electric strike replaces the standard strike plate and lets a normal latch release on command, which suits most interior and many exterior doors. A magnetic lock, or maglock, uses a powerful electromagnet to hold a door shut and is common on glass storefront and double doors. Whichever you use, fire-code requirements for safe exit must be respected, so the hardware is paired with the proper exit devices and power supplies so people can always get out even during a power loss.

• Match the reader to the credential: proximity, keypad, biometric, or combination
• Use software schedules so doors auto-unlock for business hours and lock after
• Group permissions so each person's credential opens only the doors they need
• Choose electric strikes or maglocks per door, always with code-compliant safe exit

Choosing and Planning a System for Your Space

Start by mapping which doors you actually want to control and who needs to pass through each one. A small office may only need the front door and a back entrance on the system, while a property with shared tenants, a warehouse, and an office area will want different permission groups for each zone. Listing your doors and your groups of people first makes every later decision, reader type, credential type, and number of controllers, much simpler.

Next, decide how much you want to manage access remotely versus on site. If you have multiple locations or want to add and remove people from your phone, a system with cloud or networked management is worth it. If you have a single small space, a more contained system can still give you the core benefits of keyless entry, instant credential changes, and an entry log. Either way, plan for growth: it is far cheaper to install a controller with spare door capacity now than to rip and replace later.

Access control also works best as part of a broader security picture. Pairing controlled doors with security cameras lets you match an entry log to actual footage, and tying in alarms or intercoms covers what happens when someone without a credential arrives. For homes and businesses across San Francisco, San Jose, Oakland, and the wider Bay Area, Peninsula, and South Bay, Access Control Bay Area designs, installs, and services these systems for both commercial and residential properties. When you are ready to plan or expand a system, call (669) 777-6811 to talk through your doors, your people, and the right hardware for your space.